The reform council has proposed that the new cybersecurity bill empower a commission to access any information in the private sector in addition to government agencies' data in the face of cyber threats.
The cybersecurity commission, which is yet to be set up, must seek a court order before doing so but may act first and report to the court later in cases of emergencies.
The National Reform Steering Assembly (NRSA) on Monday proposed and discussed as an urgent agenda item further changes to the cybersecurity bill already approved by the cabinet.
The move was apparently in response to the cyber attacks in 150 countries that disrupted public services and businesses over the weekend.
Apart from access to the private sector's information, the NRSA's mass media panel proposed that Gen Prayut Chan-o-cha use his absolute power to set up a new cybersecurity commission to perform the duty until the one under the new law can be formed. It also wants to add criminal penalties -- imprisonment and fines -- to the bill.
The definition of "cyber" was also revised to cover all types of networks -- computers, communications, telecommunications and the internet, as well as satellite, utility and public services including transport systems, said Pol Maj Gen Pisit Pao-in, vice-chairman of the NRSA's mass media panel, which proposed the changes.
"These are now defined as national networks and [damage done to them] must not affect national security -- the military, internal order and the economy," he said.
The composition of the national cybersecurity commission will also be changed.
In the previous versions of the bill, the commission will be chaired by the digital economy minister. The NRSA now wants the prime minister or his assigned deputy as chairman. Its vice-chairmen will be the defence minister and the digital economy minister.
"As cybersecurity involves all sectors, it's more appropriate to have the prime minister as chairman to ensure a common direction and efficiency," he said.
The NRSA also changed the status of the commission so it becomes a government agency at the department level and reports directly to the prime minister. The previous versions stipulate the commission as a juristic person.
"The purpose is to expedite command. The cybersecurity commission has the power to supervise to ensure cybersecurity. It may order a government agency or the private sector to do or not to do anything. It can also access digital data of government agencies and the private sector when there are threats," he said.
To ease the privacy concern, the bill requires that in order to do so, a court order must be obtained, except during emergencies, when officials may seek approval from the commission to access information and report to the court without delay, he added.
Punishments were also revised to include criminal penalties. In the previous versions, heads of government agencies who fail to comply with the law face disciplinary action.
"To keep abreast of the situation, we also propose that the government quickly send the bill to be enacted by the National Legislative Assembly. In the meantime, Gen Prayut should use his power under Section 44 of the 2014 interim constitution or Section 265 of the 2017 charter to set up the cybersecurity commission. Once the bill is enacted, its operations will be transferred to the new commission and its past actions shall be considered done by the new commission."
Not all NRSA members agreed with the changes on Monday. Some argued the definition of cyber was too broad and the power that extended to the private sector might restrict civil rights and liberties.
Kamnoon Siddhismarn had problems with Section 44(3) of the bill, which authorises officials to access information and communications both in the form of postage mail, phone calls, fax correspondence, data in computers and all communication devices and proceed as appropriate with court orders, except during an emergency.
"If the commission can order the private sector, what's the guarantee that officials will not exploit these powers to restrict civil rights and freedom of expression," he asked.
He suggested that the law should spell out clearly these powers might not be used to restrict freedom of expression.
The meeting acknowledged the report and will send it to the cabinet and the Council of State for further consideration. If the cabinet agrees with it, it will be sent to the NLA for enactment.